The all in one place for non-profit security aid.
The NPM (Node Package Manager) registry suffers from a security lapse called “manifest confusion,” which undermines the trustworthiness of packages and makes it possible for attackers to hide malware in dependencies or perform malicious script execution during installation. […] Read More
BleepingComputer
Malvertising meets SEO poisoning. Fast moving on MOVEit exploit remediation. Ransomware trends. Cyberespionage, sanctions, and influence ops. Ave atque vale Kevin Mitnick.
Sophos analyzes malvertising through purchased Google Ads. The MOVEit vulnerability is remediated faster than most. The DeliveryCheck backdoor is used against Ukrainian targets. SORM is under stress. Ukrainian police roll up another bot farm working in support of Russian influence operations. AJ Nash from ZeroFox provides insights on the White House cybersecurity labeling program. David Moulton from Palo Alto Networks Unit 42 introduces his new segment “Threat Vector.” And we bid farewell to Kevin Mitnick. Read More
The CyberWire
Linux Kernel Vulnerability (CVE-2024-26925) Let Hackers Access Unauthorized Data
[[{“value”:”
In a significant update from the Linux kernel’s security team, a critical vulnerability identified as CVE-2024-26925 has been addressed to bolster the security of systems worldwide.
The flaw was found in the netfilter subsystem, specifically within the nf_tables component, which is crucial for packet filtering and classification.
The vulnerability stemmed from improperly releasing a mutex within the garbage collection (GC) sequence of nf_tables.
Typically, the commit mutex should remain locked during the critical section between nft_gc_seq_begin() and nft_gc_seq_end() to prevent asynchronous GC workers from collecting expired objects and acquiring the released commit lock within the same GC sequence.
However, it was discovered that nf_tables_module_autoload() was temporarily releasing the mutex to load module dependencies, then reacquiring it to replay the transaction. This incorrect handling could potentially lead to race conditions, jeopardizing the stability and security of the Linux kernel.
The issue was rectified by modifying the mutex release sequence. Now, the mutex release occurs at the end of the abort phase after nft_gc_seq_end() is called, ensuring that GC workers protect the critical section from concurrent access.
Greg Kroah-Hartman, a renowned kernel maintainer, committed this change to the Linux kernel source under the patch identifier CVE-2024-26925.
In the commit message, Greg Kroah-Hartman, explained, “The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(). Otherwise, the async GC worker could collect expired objects and get the released commit lock within the same GC sequence.”
The vulnerability could affect many systems, particularly those utilizing the nf_tables for network packet filtering.
By resolving this issue, the Linux kernel developers have prevented possible exploits that could lead to system crashes or unauthorized data access.
Is Your Network Under Attack? – Read CISO’s Guide to Avoiding the Next Breach – Download Free Guide
The Linux kernel CVE team strongly advises users to update to the latest stable kernel version, which includes this patch among other bug fixes. The team emphasizes that individual changes are not tested in isolation but as part of the entire kernel release.
Therefore, cherry-picking individual commits is discouraged and unsupported.
For the most current information regarding which kernel versions remain unaffected as fixes are backported, users are encouraged to consult the official CVE entry at CVE-2024-26925 on cve.org.
This proactive patching underscores the Linux community’s commitment to security and stability. Users and administrators are urged to apply the latest updates to safeguard their systems against potential threats stemming from this vulnerability.
Combat Sophisticated Email Threats With AI-Powered Email Security Tool -> Try Free Demo
The post Linux Kernel Vulnerability (CVE-2024-26925) Let Hackers Access Unauthorized Data appeared first on Cyber Security News.
“}]] Read More
Cyber Security News
CISA Warns Organizations of Exploited Vulnerability Affecting .NET, Visual Studio
CISA has added CVE-2023-38180, a zero-day vulnerability affecting .NET and Visual Studio, to its Known Exploited Vulnerabilities Catalog.
The post CISA Warns Organizations of Exploited Vulnerability Affecting .NET, Visual Studio appeared first on SecurityWeek.
SecurityWeek RSS Feed